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ABSTRACT 

The  article  describes  the  approaches  how  to  assess  the  internal  and  control  risk.  Proposed  the  actions  of  the 
auditor  in  assessing  two  components  of  audit  risk  which  can  be  applied  by  company.  Besides  of  it  analyzed  methods  of 
assessment  of  internal  and  control  risk  which  can  significantly  simplify  risk  assessment  and  reduce  labor  costs  for  its 
implementation. 
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INTRODUCTION 

The  internal  risk  in  the  West  is  often  referred  to  as  an  inherent  risk.  Western  auditors  interpret  the  concept  of 
internal  (on-farm,  inherent)  risk  somewhat  more  broadly.  So,  according  to  SAS  47  the  inherent  risk  is  the  exposure  of  any 
indicator  to  material  distortion,  provided  that  there  is  no  related  distortion  of  rules  or  procedures  within  the  internal 
management  structure.  Inherent  risk  includes  the  relative  risk  of  distortion  of  some  indicators,  as  well  as  external  factors  - 
technological  advances  or  the  deterioration  of  the  situation  in  the  industry  [1], 

And,  according  to  SAS  47,  the  risk  of  control  is  the  risk  that  the  occurrence  of  a  material  misstatement  of  a  record 
in  any  indicator  of  financial  statements  will  not  be  prevented  or  detected  in  a  timely  manner  using  the  rules  and  procedures 
of  internal  control  [1]. 

Internal  and  Control  Risk 

At  the  planning  stage  of  an  audit,  it  is  rather  difficult  to  assess  internal  risk  with  high  accuracy,  therefore  we,  as 
one  of  the  possible  options,  suggest  the  following  approach  -  the  use  of  interval  risk  assessment  based  on  the  subjective 
opinion  of  the  auditor.  This  approach  is  formally  applicable  at  all  stages  of  the  audit,  but  it  is  particularly  relevant  at  the 
planning  stage.  For  interval  estimation,  two  approaches  can  be  used: 

•  A  simple  indication  of  the  interval,  for  example,  IR  (0.4...  0.5); 

•  Using  the  normal  law  of  distribution. 

In  practice,  a  simple  indication  of  the  most  likely,  in  the  opinion  of  the  auditor,  the  value  of  the  risk  range  is 
sufficient.  It  is  obvious  that  the  smaller  the  difference  between  the  lower  and  upperrisk  estimates,  the  higher  the  auditor's 
confidence  in  the  accuracy  of  this  assessment.  For  new  customers,  as  a  rule,  the  difference  between  the  lower  and  upper 
estimates  should  be  significant,  for  example,  IR  (0,6..  1,0),  for  old  clients  the  range  may  already  be,  for  example,  IR 
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(0,6.0, 7). 

The  second  approach  to  the  assessment  of  internal  risk  is  the  application  of  a  test  system  (question-answer),  to 
which  the  auditor  himself  answers  and  in  which  information  about  the  enterprise  is  laid.  Moreover,  information  can  be 
obtained  even  before  the  start  of  the  inspection,  for  example,  during  the  conduct  of  a  preliminary  examination.  Such 
information,  in  particular,  may  include  indicators  of  external  financial  statements,  number  of  personnel  (including 
accountants),  applied  accounting  system,  activities  of  the  enterprise,  etc. 

A  feature  of  this  approach  is  the  need  for  appropriate  software  to  analyze  the  results  of  the  survey.  It  would  be 
convenient  to  use  neural  network  models  as  such  software.  Such  models  have  an  extremely  important  feature  -  the 
possibility  of  learning  and  self-learning.  Having  trained  the  neural  network  on  the  basis  of  materials  of  enterprises  where 
an  internal  risk  assessment  has  already  been  carried  out,  the  auditor  has  the  opportunity  to  assess  the  internal  risk  of  new 
enterprises.  Using  the  possibilities  of  training  and  self-learning,  having  information  on  already  proven  enterprises,  it  is 
possible  to  determine  with  high  accuracy  the  internal  risk  for  new,  previously  untested  economic  entities. 

The  question  may  arise:  why  did  we  initially  determine  the  internal  risk  by  introducing  an  interval  estimate? 
Interval  estimation  has  a  difficult  application  in  mathematical  models.  Indeed,  it  is  not  easy  to  directly  use  the  interval 
estimate  in  the  model.  However,  this  is  not  required:  interval  estimation  characterizes  the  subjective  opinion  of  the  auditor 
on  the  internal  risk  of  a  given  client.  The  second  approach  we  proposed  allows  us  to  proceed  to  a  strictly  quantitative 
assessment  of  internal  risk. 

Knowing  the  results  of  two  assessments,  the  auditor  at  the  final  stage  takes  the  specific  value  of  internal  risk  and 
uses  it  in  the  model.  Moreover,  the  choice  is  made  on  the  basis  of  professional  judgment  with  the  use  of  the  principle  of 
caution  (prudence). 

The  actions  of  the  auditor  in  assessing  internal  risk  can  be  proposed  as  follows: 

•  The  method  of  expert  assessment  (MEO)  (subjective  assessment),  then  the  decision  on  the  value  of  internal  risk; 

•  Estimation  using  the  neural  network  model,  the  decision  on  the  value  of  internal  risk. 

From  the  point  of  view  of  verifying  the  registration  of  primary  documents,  the  auditor  is  faced  with  one  of  two 
options:  the  document  is  drawn  up  correctly  or  with  violations.  Execution  of  a  document  with  violations  indicates  the 
ineffectiveness  of  internal  control,  but  by  itself  does  not  allow  to  assess  its  measure.  To  do  this,  you  need  to  know  the 
number  of  documents  that  are  aligned  as  a  result  of  exposure  to  the  control  environment.  In  practice,  it  is  difficult  to  obtain 
such  information,  in  most  cases  document  does  not  differ  from  the  document  originally  compiled  correctly. 

When  comparing  the  concepts  of  internal  and  control  risk,  it  is  impossible  not  to  pay  attention  to  the  fact  that  both 
these  risks  are  internal  for  the  enterprise  and  external  for  the  auditor.  Indeed,  the  auditor  is  not  able  to  directly  affect  their 
value.  Only  in  subsequent  reporting  periods,  these  risks  can  be  reduced  by  the  recommendations  of  the  auditor.  In  addition, 
from  the  point  of  view  of  the  possibility  of  quantitative  assessment,  their  separate  determination  is  difficult,  since  the 
auditor  encounters  with  the  documentation,  which  has  already  passed  the  correction  stage  by  means  of  internal  control 
when  checking,  which  is  not  always  possible  to  accurately  assess.  Indeed,  with  corrections,  often  some  documents  are 
simply  re-compiled,  and  incorrect  ones  (old  ones)  are  destroyed.  Under  these  conditions,  it  is  extremely  difficult  to 
accurately  assess  the  effectiveness  of  the  control  system. 
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In  addition,  it  may  not  be  entirely  appropriate.  Because,  in  the  course  of  verification,  the  fact  of  the  presence  or 
absence  of  significant  errors  is  ultimately  important,  and  not  the  reason  for  their  presence  from  the  point  of  view  of 
whether  they  arose:  as  a  result  of  the  very  possibility  of  errors  (intra-business  risk)  or  because  not  eliminated  by  internal 
controls  (control  risk). 

Like  internal  risk,  the  risk  of  control  in  relation  to  the  client  is  the  internal  risk  of  the  client.  For  the  auditor,  risk 
control  is  an  external  risk.  It  is  impossible  to  reduce  this  risk  (at  least  at  the  planning  stage  of  the  audit),  it  is  important  to 
be  able  to  accurately  enough  estimate. 

The  initial  judgment  of  the  auditor  about  the  risk  of  control,  as  well  as  about  internal  risk,  cannot  be  sufficiently 
accurate.  This  point  of  view  of  the  author  is  also  shared  by  some  major  audit  specialists  [2], 

Therefore,  at  the  initial  stage,  it  is  appropriate  to  apply  an  interval  estimation.  Later,  during  the  process  of  the 
audit,  this  opinion  is  revised  and  clarified,  the  gap  between  the  lower  and  upper  limits  of  the  assessment  is  narrowed.  After 
testing  operations,  it  is  possible  to  assess  the  risk  of  control  using  statistical  methods.  At  the  same  time,  it  is  quite  possible 
that  it  will  be  necessary  to  make  changes  to  the  audit  plan  and  program,  especially  if  the  revised  assessment  of  the  risk  of 
control  goes  beyond  the  upper  limit  of  the  initial  (planned)  assessment.  According  to  traditional  views  on  the  audit 
technique,  the  control  risk  value  is  clarified,  as  a  rule,  in  at  least  two  stages:  after  acquaintance  with  the  organization  and 
production  of  accounting  (as  an  element  of  ICS)  and  with  the  internal  control  system  itself  (first  stage)  and  after  detailed 
tests  of  ICS  (second  stage).  Each  specification  of  the  value  of  the  control  risk  should  be  recorded  in  the  working 
documentation  indicating  the  made  (or  unproduced)  change  in  the  Plan  and  the  Verification  Program. 

One  of  the  important  methods  for  assessing  the  control  risk  is  questioning  with  the  subsequent  statistical 
processing  of  data.  It  is  appropriate  to  apply  the  "intellectual"  processing  of  the  results  of  the  questionnaire,  which  includes 
the  analysis  of  internal  contradictions  in  the  answers  of  the  respondents  and  contradictions  in  the  answers  to  the  same 
questions  by  different  respondents. 

Such  an  analysis  will  allow,  on  the  one  hand,  identifying  possible  “bottlenecks”  in  the  client’s  control  system, 
and,  on  the  other,  to  prepare  special  questionnaires  for  re-interviewing  the  same  people  with  those  questions  that  did  not 
receive  a  clear  answer  on  the  results  of  the  initial  questionnaire.  In  addition  to  re-questioning,  information  can  be  obtained 
from  oral  conversations  with  the  staff  of  the  client.  Although  the  evidentiary  value  of  these  evidences  is  low,  they  do  allow 
to  determine  the  directions  that  should  be  paid  special  attention  during  the  verification.  A  particular  difficulty  is  the 
problem  of  the  numeral  assessment  of  the  magnitude  of  the  control  risk.  To  solve  this  problem,  a  direct  assessment  is  used 
based  on  the  subjective  opinion  of  the  auditor  [3],  subjective  opinions  and  correspondence  tables  [4],  and  some  generally 
refuse  to  quantify  [5]. 

Thus,  in  the  current  practice  of  numeral  assessment  of  the  control  risk,  a  quantitative  assessment  is  carried  out  on 
the  basis  of  a  qualitative  assessment.  In  turn,  the  qualitative  assessment  is  performed  at  the  preliminary  stage  subjectively, 
at  the  subsequent  stage  using  the  test  system.  The  tests  proposed  in  the  literature  allow  us  to  estimate  the  risk  of  control 
qualitatively  (as  low,  medium  or  high)  and  are  not  without  subjectivity.  [6].  Moreover,  the  subjectivity  in  these  tests  is 
manifested  in  two  stages: 


Impact  Factor(JCC):  3.2176-  This  article  can  be  downloaded  from  www.impactiournals.us 


Kuziyeva  Dinora  Bakhodirovna 


•  Estimation  an  individual  test  question  (qualitative), 

•  Making  a  decision  on  the  results  of  testing  (it  is  not  formalized  at  all,  but  is  taken  on  the  basis  of  the  subjective 

opinion  of  the  person  who  conducted  the  testing). 

How  to  test  the  controls  with  the  subsequent  numerical  evaluation  of  their  effectiveness?  The  effectiveness  of  the 
control  environment  as  an  independent  element  of  an  enterprise  can  be  reliably  assessed  only  when  conducting  an  audit, 
starting  well  before  the  preparation  of  annual  financial  statements.  Only  in  this  case,  the  auditor  has  the  opportunity  to  at 
least  qualitatively  assess  the  effectiveness  of  the  control  system  of  the  inspected  subject. 

For  quantification,  an  appropriate  rating  system  is  required.  Formalizing  the  results  of  a  qualitative  assessment 
based  on  the  available  tests  is  practically  impossible. 

Evaluation  of  the  effectiveness  of  the  control  environment  for  the  segments  is  carried  out  simultaneously  in  two 
sections:  by  the  number  of  documents  and  by  the  sum  equivalent  of  the  operations  of  these  documents.  The  essence  of  the 
assessment  is  to  identify  those  documents  that  were  initially  taken  into  account  and  reflected  with  errors,  and  then,  as  a 
result  of  the  control  environment,  these  errors  were  corrected. 

To  do  this,  it  is  necessary  to  identify  the  documents  that  were  initially  reflected  incorrectly,  which  is  quite  difficult 
in  practice,  since  corrections  are  often  made,  by  re-registering  the  business  transaction,  which  eliminates  the  possibility  of 
control  by  auditors.  Only  some  software  tools  (but  not  all)  allow  you  to  track  and  record  all  changes  made  to  the 
accounting  database. 

However,  it  is  still  possible  to  obtain  some  information  about  the  effectiveness  of  the  control  environment,  for 
example,  information  about  corrected  incorrect  assignments  of  primary  documents,  corrected  incorrect  amounts  in  reports 
of  reporting  persons,  etc. 

The  effectiveness  of  internal  control  is  calculated  as  the  ratio  of  the  number  (amount)  of  documents  in  which 
errors  are  eliminated  to  the  total  number  (amount)  of  documents  in  which  errors  occurred  before  the  impact  of  the  control 
environment. 

The  risk  of  control  is  the  value  of  the  inverse  efficiency  of  internal  control  and  is  estimated  as  the  ratio  of  the 
number  (amount)  of  documents  in  which  errors  have  not  been  eliminated  to  the  total  number  (amount)  of  documents  in 
which  errors  occurred  before  the  impact  of  the  control  environment. 

Based  on  the  evaluation  results,  the  following  are  also  automatically  calculated  indicators: 

•  Total  control  risk  (average), 

•  The  maximum  value  (by  quantity  and  amount). 

According  to  the  results  of  comparing  the  average  and  maximum  values  of  the  risk  of  control  in  quantitative 
(qualitative  assessment)  and  total  terms  (which  is  more  accurate  and  correct),  the  auditor  decides  on  the  “decide  value”  of 
the  risk  of  control.  The  advantages  of  this  method  of  assessment,  according  to  the  author,  are: 

•  Clear  formatting  of  both  the  source  data  and  the  results. 

•  The  relative  ease  of  use. 
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Assessment  of  control  risk  by  segment  is  carried  out  simultaneously  in  two  sections:  by  the  number  of  documents 
and  by  the  sum  equivalent  of  the  operations  of  these  documents.  The  essence  of  the  assessment  is  to  identify  documents 
(operations)  that  contain  errors  (incorrectly  reflected  in  the  account).  These  documents  (operations)  are  entered  in  the  lines 
of  the  form  (form)  corresponding  to  the  nature  of  the  violation. 

According  to  the  results  of  comparing  the  average  and  maximum  values  of  control  risk  in  quantitative  and  total 
terms,  the  auditor  makes  a  decision  on  the  accepted  value  of  the  integral  indicator  of  internal  risk  and  risk  of  control. 

The  advantages  of  this  method  of  assessment  are: 

•  Availability  of  the  necessary  information  base, 

•  The  simplicity  of  calculations  (minimum  labor  costs), 

•  High  reliability  (due  to  the  non-use  of  the  sampling  method  in  the  formation  of  the  initial  data). 

The  judgment  about  the  internal  (inherent)  risk  is  estimated  by  us  subjectively  at  the  planning  stage  of  the  audit 
and  during  the  audit,  as  a  rule,  does  not  change.  The  judgment  of  the  risk  of  control  during  a  review  may  change  more  than 
once. 

The  risk  of  undetected  can  also  change,  for  example,  when  the  sample  size  changes  as  a  result  of  a  change  in  the 
test  program.  With  a  constant  acceptable  risk,  the  risk  of  failure  to  detect  may  change  if  you  change  the  judgment  of 
control  risk,  which  will  require  a  change  in  the  sample  size. 

CONCLUSIONS 

Of  the  two  components  of  audit  risk  that  change  during  an  audit,  the  risk  of  control  is  paramount  because  of  the 
risk  of  undetected  changes  due  to  a  change  in  the  judgment  of  the  risk  of  control.  To  use  in  modeling  audit  risk,  not  only 
the  traditional  division  of  it  into  three  components,  but  also  to  apply  the  assessment  of  the  integral  indicator  of  internal  risk 
and  control  risk.  This  technique  can  significantly  simplify  risk  assessment  and  reduce  labor  costs  for  its  implementation. 
To  use  quantitative  methods  for  assessing  audit  risk  and  its  components,  not  limited  to  the  qualitative  assessment  of  "low", 
"medium"  and  "high". To  proceed,  if  necessary,  due  to  the  content  of  internal  standards,  to  a  qualitative  assessment  of  audit 
risk  based  on  the  results  of  its  quantitative  assessment,  and  not  contrariwise.  Thus,  quantitative  risk  assessment  can  be  used 
as  a  step  to  move  to  a  qualitative  assessment.  To  fix  in  the  internal  standards  of  audit  organizations  specific  methods  and 
procedures  for  assessing  audit  risk  applied  by  this  organization. 
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